Cloudflare, Inc. (NET) Earnings Call Transcript & Summary

Excellent. You hit that music queue excellently right there. I'm Keith Weiss. I run the U.S. software equity research platform here at Morgan Stanley and very pleased to have with us from Cloudflare, CFO, Thomas Seifert. Thomas, thanks for joining us.

Always a pleasure.

So Tom, we're just talking about sort of the uncertainty in the environment right now when it comes from the current administration on sort of the tariff landscape but also some of the geopolitical. I was hoping maybe we could start out and get kind of your perspective on...

Like an easy topic.

How are your customers kind of navigating this environment? How are they feeling about sort of their initiatives, what they need to spend on? Because, to a certain extent, Cloudflare, because it's helping you provision your applications and deliver them securely, is helping you secure your users, those tend to be more durable demand items for most customers that we talk to.

Yes. When we were in our fourth quarter earnings call, we said the -- there were 2 years of scrutiny on IT spend on budget, people very diligent how they allocated capital. And we thought we saw the first signs of green shoots coming out, especially when it comes to digital transformation, people leaning in and also security spend. And that has continued going into the first quarter. At least in January, the last weeks are a little bit more uncertain in terms of the surprises we see. I'm sure that shifts priorities in terms of what folks need to deal with in terms of adjusting supply chains or not. From our perspective, and I mentioned it before, I just came back from the security conference in Munich, the cyber landscape is still what it was. So these conversations with customers in terms of readiness and preparedness are progressing well. We don't have -- we have not seen any changes yet. Maybe it's too early. But I think that part of the world is still more a tailwind to us than a headwind. But who knows, the surprises are -- from a geopolitic and macro landscape are very recent. We'll see how this will impact us moving forward. But I -- we have not seen any changes yet, so cautiously optimistic.

Got it. So if we think about Cloudflare more broadly, you guys benefit from a durable kind of demand landscape out there. The cyber threat isn't getting any easier. The necessity to deliver your application functionality or to provision your users safely isn't going anywhere. You guys, over the past really 10 years, have well expanded out the solution portfolio. We're talking about kind of multiple waves of growth in front of Cloudflare. In 2025, there's another, I think, element or axis of the equation that came on view in terms of new sales leadership. And you guys have talked about 2025 being an inflection point in that regard in terms of how you could service your customers. Can you talk to us about kind of what happened? And how does that change the opportunity or maybe Cloudflare's ability to, well, go after that opportunity?

I mean hard to believe we've been around for 10 years now or longer actually. And the business model has evolved. We started as a freemium model, pay as you go where folks just gave us a credit card, and we charged a fixed amount every month and then starting into enterprise. I remember when I joined, enterprise was still less than 10% of revenue. Now it's more than 90% of revenue. And we've been migrating up the customer stack. The large customers, customers north of $100,000 of revenue or ACV, our larger customer cohort has been our largest growing cohort for a while now and probably our biggest opportunity moving forward. So we have been on this go-to-market transformation now for the last, I would say, 15 to 18 months. We seem to have hit an inflection point in the fourth quarter in a couple of -- from a couple of perspectives and a couple of factors. First, I would say that large customer momentum has not only continued but has accelerated. We talked on the fourth quarter earnings call about the largest deal we ever signed, north of $20 million of TCV. And if you look at the pipeline, it reflects that this trend is going to continue. And I think it's to a large extent but not only a result of the transformation on the go-to-market side with Mark Anderson. We have seen significant progress in sales productivity over the last 5 quarters. We've seen ending the year with their first net sales capacity addition in a long time. We've seen that not only did productivity increase, but also attainment across. The AE population shifted significantly to the right. And I think with Mark, this continued focus on improving sales execution, forecasting, sales operation has really made a big step forward. So as we enter -- and with that, most of the growth we have experienced last year was a productivity gain. It will switch from productivity to just being able to add sales -- net sales capacity over the course of this year, so very exciting from a go-to-market perspective.

Got it. So there's 2 big hires from Cloudflare. One that you talked about in terms of Mark Anderson, really seasoned security enterprise sales executive, and we're seeing the results in the results, like you're saying, in the most recent earnings. The other one is CJ Desai, great product executive coming most recently from ServiceNow. Can you talk to us a little bit about what CJ brings to the equation? Because Cloudflare has always been a great product company. It's always been about -- like you guys have 30,000 engineers trying to get like every single job at...

I wish we had. Yes.

What does CJ add to the overall equation at Cloudflare?

Well, it's interesting. Yes. Somebody else asked me this today, and I said, the first observation I had was the first 3 months, he didn't even spend with his product team. He literally traveled the world and talked to every large customer we have and every large customer we should have and came back with this long list of things that he wants to do, all very tactical but also informed us about what we want to do moving forward. We had internal kickoff for the year just a couple of weeks ago, and we talked about how busy we were as an organization with our go-to-market transformation over the last 15 to 18 months. And while we are happy with our innovation engine, that was always the heart and is still the heart of Cloudflare. This year is where we want to take that to full gear. And this is where he comes in, restructuring, reaccelerating the team. I'm sure we will cover that in a minute. But apart from the products we have and the product opportunity, this new opportunity of where the network is, the architecture and how it will play in a world where AI is moving and inference tasks are moving to the edge of the network, we have to reconfigure and fine-tune the network from a CPU, GPU storage capacity and even better interlink it with the tools. I remember when you and I first met at the teach-in for the IPO, we said the network is the competitive moat for the Cloudflare business model. And this continues to be even more true moving forward. And his role into making sure that we that we play on that strength, I think, is going to be crucial. The second part I think is -- apart from that is with Mark Anderson, we got really this great go-to-market executive. But CJ brings a completely different angle to how -- to our customer opportunity. His network is CISOs and CTOs. So it's almost like you open another 2 doors to the customer with him joining Cloudflare.

Got it. So maybe that's a good kind of segue to talk a little bit about that AI opportunity and the AI initiatives going on within Cloudflare and kind of going a little bit in reverse order. But just pulling on the thread of what you talked about in terms of the network being the moat. The network is also now sort of the development platform and having built that development platform fundamentally different from sort of other platforms is emerging as more of the differentiators, emerging as sort of the catalyst for you guys to be able to put out solutions that hit the mark quicker than most. So can you talk to us about how Cloudflare is seeing that AI opportunity kind of emerge within Workers? And what are the key milestones us as investors externally should be looking at?

We launched Workers AI now about 17 months ago, and we said -- Matthew said 17 months ago, that sounded quite visionary. We see this as the big opportunity for Cloudflare moving forward. As AI moves from training to inference, we will see the windfall of this enablement. The network is built to run tasks at this Goldilock of compute performance and latency as close to the eyeballs as you can get. Today, we are less than 50 milliseconds away from 99.9% of the things that want to connect to the Internet. And that was already the strength for all the traditional products we have built so far, but being able to now run inference tasks at the edge of our network will be the next big opportunity. We started to launch Workers AI, as we said, 17 months ago. We didn't push for dollars, was one of the other visionary things but tried to push adoption, so we could use and learn from the diversity of inference tasks that folks would put on our network. What does it take from a compute perspective? What GPUs do we need? How can we improve scheduling tasks? How can we get moving forward GPU utilization into the neighborhood of where the rest of the network runs? And for those of you who are not so familiar with it, when we talk about the competitive moat, this network today is now in more than 500 locations, 400 cities, 100 countries in a way that allows us to offer every product and every service we have to run on every server in every location. So this whole surface of the network is our degrees of freedom, how we operate, compute performance, cost, bandwidth. And if we are able to extend that into the world of inference tasks, then this competitive moat just becomes higher. Last year, we enriched this by putting a lot of new features around Workers AI, higher-performant GPUs, an AI gateway, vectorized data bank to address larger index windows. And we talked about the first very large inference customer wins in terms of revenue, a $7 million customer in the fourth quarter. From a momentum perspective, we see this now gaining momentum.

Got it. And recently, you've expanded that purview from some of the areas that Cloudflare is well known for, right, being able to provide an easy-to-use development platform but that low latency being close to the end customer, bringing the right kind of CPU, GPU combination. But you've expanded into agents, and I think that was a little bit more surprising for people why Cloudflare would be a good platform for agents on a go-forward basis. Can you talk to us about why Cloudflare is in that market and what your customers are looking to Cloudflare for in terms of building out agents on that network?

That's actually really interesting. So we launched a product called Workers way back. It was in 2017. And it was actually the result of us and our own development effort getting bogged down in terms of speed, how fast we can develop products. And this idea was born of Workers that, that was really a new way how you write and deploy code at the edge of the network, not on a device, not on the server, but in this Goldilocks zone of high compute performance with low latency as close to the device as possible. That was the original intent around Workers, and that's where most of our products are built on. The funny thing is the first product name for that was later called the Durable Objects. The first product name was actually supposed to be Agent. So we had no idea that we would foresee what AI agents would become. But at least that was the first time when internally this name really showed up. So now you take this idea of deploying code at the edge of the network in this Goldilocks zone of high compute performance, low latency as close to the device as possible, and that is literally what you do with AI agents, right? You want high compute performance with low latency as close as to the eyeballs that consume it. And agents are AI tasks combined with an API, so to speak. And in terms of accessing APIs and computing the inference task, turns out that the architecture of our network is not container but isolates that have almost 0 spin-up and spin-down time. The ideal architecture performance-wise, location at the edge of our network, the ideal construct from a performance and cost perspective to run inference tasks at the edge and agents, AI agents at the edge of our network, and we see customers that move from one platform to ours, see performance improvements or cost improvements in the neighborhood of 300% in this migration. So the -- I don't think we foresaw that, but we -- the architecture that was built for Workers is now what allows us to be so disruptive around AI and AI agents.

Got it. Got it. So I mentioned, we're putting the cart a little bit before the horse in terms of the order of operations starting with Workers. One of the things that's been really dynamic about the Cloudflare story since the IPO is kind of that product evolution going from Act 1 products like web application firewall and DDoS to Act 2 products, which are more on the network security side of the equation like Zero Trust security. And then Act 3 is kind of the overlay of kind of Workers on a go-forward basis. Can you talk to us about the extent to which we're laying growth on top of growth? Or has Act 1 kind of played itself out, Act 2 is where the action is, and we're waiting for act -- like how should we understand these waves of growth on a go-forward basis?

So you have to -- we -- that's the reason why we talk about them in terms of Act 1, Act 2, Act 3. And they follow after each other, but they also build on each other. Act 1 was what we call our application services. You mentioned some, load balancing, firewalling, route building. That allowed us to build the infrastructure of the network. It moves traffic or data in one direction. This is still a large market. What it disrupts is pretty much on-premise equipment, and there's still a lot of on-premise equipment out there from VPNs, firewalls and load balances that need to be disrupted. Matthew always calls this winning the war of attrition, literally sitting in front of these on-premise infrastructures and as upgrade cycles come, as expansions come, as maintenance spend is done, we get in front of that. And so this will be a market that has long legs to continue to grow moving forward, maybe not explosive, but it's a durable growth that is coming out of this segment. That allowed us to build the infrastructure for the network. What you call Act 2, Zero Trust came on top of that. That is literally taking advantage of the pipes that are there and bringing traffic back. This is what Zero Trust does. We said at our conference last year, Matthew said we could consolidate all the Zero Trust providers that are out there in the market on our network traffic-wise without spending an additional dollar, which also means that all this growth that comes is highly margin accretive because it benefits from the architecture that is already on the ground. And it benefits us because we can grow revenue significantly without investing CapEx. So from a CapEx spend perspective, that is all dollars now that moves into Act 3 and making sure that we provision the network and with that, our path forward with the right network and GPU capacity to take advantage of whatever we talked about it before.

Got it. Got it. So if we start with the Act 1, still a lot of opportunity there. The question I had was, the threat environment continues to get worse, right? The -- we're seeing meaningful acceleration in cyberattacks. AI is helping the bad guys as much as helping the good guys. Is the marketplace still in a position where an accelerating threat environment can improve growth for application services?

What the -- the size of attacks, not, right, because we -- one of the disruptive things we did was that we unmetered, so to speak, much of the products that in the past were sold by the size of traffic. So you got a DDoS attack, and the bigger the attack was, the higher the bill was that your vendor sent to you at the end of the quarter for protecting you or defending. So we unmetered that. So I think the size of the attacks doesn't really impact the business, but of course, the threat environment does. And it hasn't abated. DDoS attacks are getting bigger. Ransom attacks and phishing attacks are getting more sophisticated. We just talked about one of the takeaways from me coming back from Munich, from the security conference. There was -- that there will be more spend. There will be more trying to be independent from certain parts of the world in terms of the defense capabilities. So I think there is -- the threat environment is increasing, and it will ultimately benefit us. It's a sad thing to say, but that will be the result of it. Yes.

Got it. Got it. So we have these Act 1 infrastructure that gets put into place. You have the network in place. You've developed a Zero Trust architecture on top of it. SASE has -- and Cloudflare won more broadly, right, encompassing a whole broader range of solutions. Why is Cloudflare winning in that solution? Because a lot of the traditional competitors also have their SASE solutions. They're talking about being able to consolidate a lot of functionality onto their networks. Where does Cloudflare outperform? And how do you guys sort of accrue that share onto your network?

SASE has been, over the last couple of quarters, one of the success stories. We see accelerating momentum from a customer win perspective. And if you listen to our earnings calls, you can hear that. The wins are getting more prominent in terms of the verticals we win. They get more prominent in terms of the number of seats that come along with it, 10,000, hundred thousands of seats. And I think it's the result of a couple of things. First of all, the product is feature-wise now at a level where we can compete in every vertical and every application. I think this is a reflection you see. I think some of the change in the go to -- changes in the go-to-market side we've made, how we balance territories, the people we hired, how you overlay product, skill sets from a go-to-market perspective certainly helped. I think what we also see is that our ability to turn products into features and make them part of a platform that allows customers to consolidate spend with significant ROIs is extremely helpful. As I said, this is one of the highest margin products we have because it literally comes at 0 additional cost to run this traffic across our network, is helping. And then we also see that first -- a lot of first-generation Zero Trust wins are coming up for renewal and some of their unhappiness about product performance, pricing and sales behavior are playing in our way. So that is helping. And then the threat environment is also moving some of the large customers to split their Zero Trust solutions, one vendor to cover employees, one vendor to cover partners and contractors. And that all open doors between cycles, so to speak, before renewal comes up. So I think it's driven by multiple components. One of the reasons why growth is accelerating is coming from their Zero Trust momentum.

Got it. Got it. So if we think about it from like an industry perspective, there's a lot of network security peers that have a lot of hardware that's coming up for refresh. So we think of that as an opportunity for Cloudflare as those come up for refresh of people looking for a more modern architecture, maybe a more simplified architecture to consolidate a lot of these solutions.

For sure. I mean one of the things you have to keep in mind where this interplay comes -- plays a role, so we talked about first wave of products. About 25% of the Internet is behind our network, which means when you use our Zero Trust solution to access a cloud platform that is literally around here, that literally sits on -- in the case of Cloudflare, on the same server, sometimes on the same piece of green plastic. So in terms of latency, you don't have to hoop -- leave the network. This is super beneficial. So besides the cost and the return reasons, the performance reasons are becoming a big part of that consolidation too. And in a world where it's not only SASE that needs to do that play, but now you have agents that try to connect inference tasks with APIs, and all happens on the same server in the same location, is a huge benefit of the architecture of the network if you want to say so.

Got it. So if we extend -- so Act 1 extends pretty seamlessly into Act 2. It's like almost a direction sort of argument. The Workers solution, to what extent is that a natural extension as well? Like if we think about the sort of initial use cases, what people are using the Workers network for, how much of it is an extension of what they were sort of delivering already on your network, maybe expanding out caching capability? To what extent is it net new? Is this kind of net new applications that people are utilizing a different type of network?

Yes. I mean if you really go back when Workers started in 2017, as I said, we used it as our own form of how we develop products, how we write code. So when you -- in the early days, when customers bought Workers, what they really bought was the ability to take a standard Cloudflare product, a firewall, a router and use Workers to customize it to their very specific needs, right? And now this evolved into a way where instead of jumping at the solution at the back end, you literally start at the beginning. So today, this is much more convincing people to make the switch that in the beginning was easier with digital-native customers and developers. But today, they're the biggest -- some of the biggest users and developers on Workers AI on the platform are large Fortune 100 and 500 companies building natively on Workers.

Got it. So if you think about the portfolio of what's on Workers, we have Workers AI, which was introduced back in September 2023. You have an object storage. You have the key-value store. You have a SQL database now with D1. Is it enough, right? Is that a broad enough portfolio for people to really look at it as a core development platform?

It's getting there. We jumped north of 3 million developers just at the end of the year, and the significant jump in the trajectory of the adoption was after our last Cloudflare birthday when we launched a lot of these enrichments and new features for Workers and Workers AI. One of the things that might not have gotten enough attention yet from a Wall Street perspective is the AI Gateway, which is now this tool that allows you to control how data and IP flows and also to deal with the non-deterministic nature with large language models in terms of seeing what happens in terms of reasoning, in terms of what verticals get accessed. So now we -- Matthew talked about it, how we can use this as a new platform, how we start helping people monetize and manage content exchange between content creators and large language models. So there's a lot more than the features that you just mentioned. I think OpenAI is -- Gateway AI is probably the biggest one that has not received enough attention yet, but we're getting there.

Got it. So we have the [ 3X ], the -- a pretty comprehensive or a cohesive platform across the board. Correct me if I'm wrong, but I think based on most recent numbers, you've talked about Zero Trust SASE being about 15% of total revenues, the developer products being about 5%. So we're still kind of 80% of the revenue base is on Act 1. What's the opportunity within that base? And sort of how does that platform opportunity play out over the next couple of years?

So those are not the numbers that we quoted, just for the record. I think if you...

I took a shot.

Okay. Yes. But if you look at new ACV being generated, it has shifted to the majority. Almost 2/3 are coming now from the Act 2 and Act 3 products. Yes.

Got it. Maybe shifting gears a little bit to kind of go to market and how you guys have shifted it over the past 18 months and how it's going to continue on a go-forward basis. This year, you had a lot of success with large customers. I think you're talking about 3,500 large customers paying over $100,000 in annualized revenues. That was up 27% year-on-year. How has the sort of the land-and-expand motion changed at Cloudflare? And how is it going to change on a go-forward basis?

Quite significantly, I would say. The neat thing about a model and the business model like Cloudflare is that once you are on our network, even with one product, we see pretty much all the traffic that hits your infrastructure and all the traffic that leaves your infrastructure. And because the use of the platform is quite easy, every new feature, every new product is literally only a mouse click away. So you can now automate expansion and expansion placing. "Dear customer, do you know that 40% of the traffic that hits your infrastructure are malicious bots? So if we switch on our bot mitigation product and you switch it on for a week or 2, you eliminate 40% of malicious traffic, which makes your infrastructure more secure. And by the way, it reduces your cost because you pay for all the malicious traffic that increases your bandwidth cost." And that is pretty much true for every product you have. So once you're on the platform, the visibility we have and the visibility we can give our customers is quite unique. And this is then how you try to move toward from land to expansion. This is why this form of contracts that we have been talking about a while quite heavily over the last 2 quarters on our earnings call, this concept of what we call pool of funds where a customer literally signs a commitment, a dollar commitment over a certain period of time, has like a rate card across every product, and then whatever he consumes is up to them. But it allows us to accelerate expansion. You don't have to go through new procurement process and approval processes for every product that you want to add on. Makes our life a little bit more difficult from a forecasting perspective and how it impacts the shape of revenue. But midterm or long term, it's a unique opportunity for us to take full advantage of the platform and the ease of use of how you can expand from one product to the next.

Got it. Talking to the CFO, I got to talk about margins. We only have 2.5 minutes left, so I'll compress the discussion. On the gross margin side of the equation, 78% gross margins in the most recent quarter, above your long-term model, and you guys have been operating above that long-term model for a while. At a certain point, just like the increasing software functionality of sort of the network, SASE being a good high-margin business, does that long-term target have to come up? Or is there investment that needs to take place in the platform that's going to bring down the gross margins into that target range?

I would say we look at margin differently. We -- for us, margin, and we've been talking about this from the very beginning, was always a tool to disrupt. It allows us to disrupt the market. So we talked about we unmetered DDoS, right? This was an approach to use the margin profile we have and the strength we have in order to disrupt. Extremely high margin on Zero Trust allows us to disrupt. Now we can use the margin advantage we have to make sure we provision the network for the AI future that we see in terms of making sure we have the optimal compute capacity to enable AI at the inference task at the edge of our network. So we are comfortable with the margin -- long-term margin targets we gave. And whenever we are a little bit above it, we use it not so much to discount. We hardly ever talk about discounting at Cloudflare but to disrupt. What is the next big market we can attack? What is the next opportunity we can go after? The ability now that we can push AI adoption and developer adoption for a significant period of time in order to get to 3 million developers is how we use margins. We'd rather sacrifice a point of margin if that allows us to get to 10 million developers faster.

Got it. So maybe just one last one to wrap it up. If we think about that long-term target, and I believe you guys have a 25% long-term free cash flow margin target out there, how do you guys think about sort of time frame to getting to that long-term target versus investment in what is a quickly expanding opportunity and one that it sounds like you guys feel like you kind of have the tiger by the tail in terms of being able to go after that opportunity?

I think since we moved in this realm of being a public company, we've been super committed to the Rule of 40. We understand how important that is for our business model, for our valuation. We've been quite disciplined. And that guides that principle and how we behave and how we invest quite a lot. We also have it easy in a way because the business model allows us to invest behind demand signals. We never really were in a position where we needed to invest ahead of demand. Even now when we are in this transformation with GPU capacity, we have been diligent about it. And so I'm quite comfortable with the long-term model we have and that we are -- prudence has always been one of our strengths, how we approach our growth. And there's so much durable growth in front of us. So we -- I think we're on good track.

Excellent. Well, unfortunately, that takes us to the end of our allotted time slot. But Thomas, thanks so much for joining us.

Thank you. Always a pleasure.